Kiteworks CISO Frank Balonis emailed customers 25 September 2026 after receiving credible federal intelligence that a threat actor may attempt to target some customer Kiteworks systems over the weekend. Vendor recommended a precautionary nine-hour (press also cited six-hour UTC window) shutdown on 26 September for on-premises and customer-hosted instances, including systems not Internet-facing; Kiteworks would shut down hosted instances on customers’ behalf.

Vendor press notice (25 Sep) and SecurityWeek (28 Sep): no indication Kiteworks or customer systems were compromised; advisory preventative; known vulns said addressed in release 9.5.1.

UPDATE: vendor NOTICE as of 27 Sep — shutdown recommendation lifted for all customers; hosted systems restored. Customer emails (via SecurityWeek/Reddit) say a severe vulnerability in Advanced Forms (secure data collection; aka Secure Data Forms) triggered the action; Advanced Forms enabled for fewer than 1% of customers (under 50 orgs) and confined to that product; DPE/file collaboration/transfer/email encryption/APIs/MFT unaffected; self-hosted Advanced Forms customers should contact Support; working with partners including Mandiant; no evidence of exploitation disclosed.

UPDATE 29 Sep 2026 — BleepingComputer: vendor developed and deployed a fix during the shutdown window, applied an additional protective layer across all environments, still no indication the vulnerability was exploited, and still no public CVE ID.

Primary: Kiteworks precautionary shutdown advisory (updated 27 Sep); wires: SecurityWeek 28 Sep + BleepingComputer 29 Sep.